InterPARES Trust Project

Transcription

1 InterPARES Trust Project Research Report Title: Survey Results on the Use of Cloud Services for Records Management Purposes by International Organizations Status: Version: Date submitted: Final 2 September 2016 Last reviewed: Author: Writer(s): Research domain: URL: InterPARES Trust Project Elaine Goh, University of British Columbia Eng Sengsavang, University of British Columbia Legal

2 Document Control Version history Version Date By Version notes 1 1 Feb 2015 Elaine Goh Eng Sengsavang Emily Chicorli Draft survey results prepared for the IPTrust Plenary meeting February Feb 2016 Elaine Goh Updated survey returns: (total of 42 completed responses) Draft survey results prepared for the IPTrust Plenary meeting in Feb Oct 2016 Corinne Rogers Minor copy edits 2

3 1 Objective of Study The survey with international organizations (IOs) constitutes part of the ongoing research on the use of cloud services by IOs. The research questions for the project are: What are the drivers and barriers for the deployment and use of cloud services by international organizations? What are the associated risks to extraterritoriality and inviolability of records and archives when international organizations delegate their records to the cloud? How can risks be mitigated and benefits enhanced when/if international organizations decide to entrust their records to the cloud? How can the outsourcing of records of international organizations to the cloud best be reconciled with the principles of extraterritoriality and inviolability? While some of the above research questions will be addressed through a literature review and through interviews with relevant stakeholders from IOs, the survey results largely address questions on the deployment and uses of cloud services. The survey also provides insight in the form of an environmental scan on the use of the following: Perceived drivers and barriers on the deployment and use of cloud services by IOs; An overview of whether IOs have started or are considering using cloud services; Types of business services and records deployed to the cloud; Negotiation of service level agreements (SLAs) for cloud services; Development of policies relating to the management of records and data. 2 Implementation of Study Before commencing the study, the project team sought approval from the University of British Columbia (UBC) Behavioral Research Ethics Board. The project team first conducted a pilot test of the survey with selected researchers from the InterPARES Trust Transnational Team. Members of the Transnational Team also reviewed the survey questions during the Transnational Research Team meetings. The pilot test and the feedback from the Transnational Team researchers resulted in improved clarity of questions. For example, we provided more options for respondents to choose when answering certain questions to allow for a more graded response, enabling respondents to 3

4 express a favorable, neutral, or unfavorable attitude or opinion. The pilot survey also provided us with an opportunity to test the use of the online survey tool and to test that the average time spent for the survey would be limited to about 30 minutes. In this regard, we found the pilot survey useful, since respondents on average spent about 19 minutes to complete the survey. The survey was launched between 12 September December 2015 through the use of the online survey tool LimeSurvey. Invitations for respondents to participate in the survey were disseminated through the listserv of the Section of International Organizations (SIO), International Council on Archives and LinkedIn group of the SIO. Researchers from the Transnational Team also played an instrumental role in sending the invitations to their contacts, and relevant stakeholders within their organization, such as information technology professionals and legal departments. The original plan was to close the survey within one month after its launch. However, as the response rate was fairly low, the project team decided not to close the survey and to send targeted s to some 120 IOs. These s were sent to either generic addresses of records/archives departments, information management, information technology, legal, communications and general administrative services, or specific individuals from these relevant functional areas. The team also invited interviewees to complete the survey. In total, the survey resulted in 42 completed responses and 55 incomplete responses. Out of the total of 54 incomplete responses, 67% of individuals answered zero questions and the mean average on the number of questions answered was 3. We have excluded the incomplete responses in our findings since they may compromise the credibility of the findings. 3 Survey Findings 3.1 Background of Respondents The majority of respondents, comprising slightly more than half of the total of 42 people (57%), work in the area of records/archives. About a quarter of the respondents (26%) work in the information technology field, while 7% of respondents work in the area of communications/public records. 4

5 Figure 1: What is your area of responsibility in your organization? Half of the respondents (52%) are professionals with management responsibilities, while 38% are professionals. 7% of the 40 respondents are senior managers. The results indicate that a significant number of respondents (36%) have worked for less than 5 years within their current organizations, or for more than 15 years within their organizations (31%). Figure 2: How would you describe your level of responsibility in the organization? 5

6 More than 15 years (13) 30.95% Less than 5 years (15) 35.71% years (7) 16.67% 5-10 years (7) 16.67% Figure 3: How many years have you worked in your organization? 3.2 Background of International Organizations (IOs) Approximately 76% of respondents categorized their organization as intergovernmental, 14% identified themselves as other, and 10% said that their organization is nongovernmental. The majority of respondents (74%) claimed that the headquarters of their organization is based in Europe, while 19% answered that their headquarters are based in North America. 74% of the respondents said that their organization has field/satellite units, while 26% do not have satellite units. Figure 4: Which of the following categories best describes your organization? 6

7 Figure 5: Where are the headquarters of your organization? Original question provided respondents with a drop-down list of countries. For the purpose of data analysis, we grouped responses by continent. Figure 6: Does your organization have satellite/field units? 7

8 About 38% of respondents work in organizations employing between 1,000-4,999 people, 33% work in organizations with less than 1,000 employees, while 29% of employees work in large organizations staffed by more than 5,000 people. 3.3 Use of Cloud Computing by International Organizations Figure 7: What is the approximate number of persons employed by your organization? Original question provided a more graded range of figures, but since the percentages for some of the categories were relatively low, we grouped the sizes of organizations into three broad categories. 83% of respondents indicated that their organization has used cloud computing. However, 55% of the total number of respondents asserted that their organization uses cloud computing in limited ways, 24% of organizations use cloud computing only exceptionally, and only 5% use cloud computing at a large scale. A total of 12 % of organizations do not use cloud computing at all, while 5% do not know whether their organization uses cloud services. Although about half of the respondents reported that their organization has used cloud computing in limited ways, we project that more IOs will increasingly be exploring the use of cloud services. This is based on 64% of respondents who indicated that their organization will be using cloud services in the next one to three years. Figure 8: Has your organization used cloud computing? 8

9 Figure 9: Are there, to your knowledge, plans within your organization to adopt and use cloud computing? When asked which organizational departments play a leading role in the adoption of cloud services in IOs, 76% of respondents answered that the information technology department plays a leading role, whereas only 10% of respondents claimed that the archives/records management unit plays a leading role. 7% of respondents also reported that other departments play a leading role. Respondents who selected the other category gave varied responses as to who plays a leading role in the adoption of cloud computing in their organization. One respondent said that individuals from information technology, legal, archives, and records management departments work together to play a leading role, while another respondent claimed that all departments except information technology and records management play a leading role. Another respondent reported that the field operations support unit plays a leading role. Figure 10: Which department plays a leading role in the adoption of cloud services in your organization? 9

10 3.4 Types of Deployment Model Used by International Organizations 48% of the respondents reported that their organization uses private cloud services, while 33% reported the use of public clouds. 31% of respondents claimed that their organization is studying the option of using cloud services. We also analyzed the type of cloud deployment model by the size of organizations. The top choice on the type of deployment model in organizations with 1,000-4,999 employees is similar to that of organizations with 999 and fewer employees. Close to half of the respondents (43%) who worked in organizations with 999 and fewer staff use private clouds. Similarly, the top choice on the deployment model from respondents who worked in organization with 1,000-4,999 employees is private cloud (69%). About 42% of respondents who work in larger organizations with 5,000 or more employees are exploring the option of using cloud services. In other words, larger sized organizations with 5,000 or more employees take a cautious approach in the adoption of cloud services Figure 11.1: What type(s) of deployment model does your organization use for cloud services? This question allows respondents to select multiple options. 10

11 Figure 11.2: Cloud Deployment Models by Size of Organization 3.5 Types of Business Services and Records/Data Deployed to the Cloud The top five business services deployed to the cloud include web-conferencing (50%), websites and social media (48%), file sharing (33%), data storage and backup (21%), (19%), and the use of office software (19%). 17% of respondents reported the use of other business services, including human resource recruitment tools and the management of library data. For the type of records and data deployed to the cloud, the top two categories include websites and social media (45%), while 24% of responses are in the other category (for example, personnel recruitment data, travel records, contract management system, library and online information resources, and logistics). 19% of respondents claimed that the question is not applicable to them. 19% of respondents also reported that records are deployed to the cloud, and this was followed by data hosted from intranet sites (17%). Figure 12: What types of business services does your organization deploy to the cloud? 11

12 Figure 13: What types of records/ data have your organization deployed to the cloud? 3.6 Drivers for Using Cloud Computing The top perceived drivers for cloud computing are: improved scalability of information infrastructure (76%), enhanced availability (69%), cost savings in hardware and software (69%), ease of deployment in setting up and implementing a system (55%), and increased flexibility (55%). Figure 14.1: How would you rank, from your perspective, the following issues as drivers for the adoption of cloud services in your organization? This question allows respondents to select multiple options. 12

13 We closely examined the perceived top drivers for cloud computing by the occupation of the respondents. The perceived top drivers for cloud computing among the IT professionals differ slightly from the records/archives professionals. While 82% of IT professionals view improved scalability of information technology infrastructure as the top driver for cloud computing, slightly lower percentages (71%) of records/archives professionals agree. In addition, while 72% of IT professionals view increased flexibility as a driver for cloud computing, only 46% of records/archives professionals agree. Figure 14.2: Drivers for the adoption of cloud services by profession. 13

14 3.7 Barriers to Using Cloud Computing The survey results indicated that the top five barriers to the adoption of cloud computing are: lack of protection of personal data/data breaches (93%), concerns over ownership and custody of records (88%), concerns over IT security (86%), compromise the inviolability of records (81%), and concerns over the applicability of domestic laws on data stored and processed outside international organizations (74%) and concerns over protection of intellectual property (74%). Figure 15.1: How would you rank, from your perspective, the following issues as barriers for the adoption of cloud services in your organization? There are some differences between the perceptions of the barriers to using cloud computing between records/archives professionals and information technology professionals. While 100% of records/archives professionals view lack of protection of personal data/data breaches as a significant concern, a slightly lower percentage of information technology professionals (91%) view it as a barrier. 92% of records/archives professionals view IT security as a barrier, whereas only 73% of IT professionals consider it as a barrier. In addition, 91% of information technology professionals perceive uncertainty over applicability of domestic laws on data stored and processed outside the premises of international organizations as a barrier for the adoption of cloud computing, while 67% of records/archives professionals view it as a barrier. 14

15 Figure 15.2: Barriers to the adoption of cloud services by profession. 3.8 Levels of Involvement in Evaluating and Implementing Cloud Services Half of the respondents (50%) reported that they are partly involved in evaluating and implementing cloud services in international organizations. A close to similar percentage of respondents claimed that they are either not involved in evaluating and implementing cloud services (24%), or that they are largely involved (21%). Figure 16: How involved are you in terms of evaluating and implementing cloud services for your organization? 15

16 We analyzed the level of involvement of the respondents in evaluating and implementing cloud services by their occupation type. The results reflected a significant difference between information technology professionals and records/archives professionals. While 63% of information technology professionals said that they were largely involved in evaluating and implementing cloud services, only 4% of records/archives professionals are largely involved in the same process. 29% of records/archives professionals also reported that they are not involved in evaluating and implementing cloud services, whereas there were no information technology professionals who claimed that they were not involved in the evaluation and implementation process. 3.9 Service Level Agreements for Cloud Services in International Organizations 29% of respondents claimed that they do not know whether their organization negotiates a service-level agreement for cloud services. Similarly, 29% of respondents also claimed that the question on the negotiation of service level agreement is not applicable to them since their organization has not implemented cloud computing. 26% of respondents claimed that their organization negotiates a service level agreement. Figure 17: Did your organization negotiate a service-level agreement for cloud services rather than accepting the agreement provided by the service provider? 16

17 In terms of the level of involvement in drafting a service level agreement, 38% of respondents claimed that they are not involved, while 26% claimed that there are partly involved with other colleagues. We noted a slight discrepancy between the number of respondents who answered that this question was not applicable to them (26%) versus 29% of respondents who answered that the previous question on service-level agreements (figure 17) was not applicable to them. Figure 18: How involved are you in drafting a service level agreement for cloud service providers in your organization? There is a significant difference in the respondents level of involvement in drafting a service level agreement by the type of occupation. Unlike records and archives respondents who reported a nil return for being largely involved in drafting the service level agreement, 36% of information technology respondents claimed that they are largely involved. 46% of records/archives respondents also reported that they are not involved in drafting a service level agreement. By contrast, only 9% of information technology professionals said that they are not involved. 17

18 Figure 19: Involvement in drafting a service level agreement by profession Personal Devices to Access International Organization s Records and Data An overwhelming 79% of respondents reported that they use their personal devices to access their organization s records and data. 79% of the respondents use their personal devices to access and send s, 36% of them use their personal devices to access and update documents or files, and another 36% use their personal devices to access and update their organization s websites and social media sites. 18

19 Figure 20: What types of information from your organization do you access from your personal devices? 3.11 Policies Relating to the Management of Records and Data Section 3.11 will highlight aspects from the survey results on the development of policies relating to the management of records and data. A breakdown of the results of other policies not discussed in this section is highlighted in Annex A. 88% of respondents reported that their organization has policies governing the retention and disposal of records, and 83% of respondents said that their organization has policies governing data protection/information privacy. In contrast, a significantly lower percentage of respondents claimed that their organization has policies relating to the outsourcing, transfer and processing of data external to their organization (40%). Figure 21: Does your organization have policies regarding outsourcing, transfer and/or processing of data external to your 19

20 4 Summary Although the survey had a limited number of respondents, the survey results do provide an overview of the use of cloud computing services by IOs, and an indication of the perceived drivers of, and barriers to, using cloud computing. Furthermore, a significant percentage of our respondents, totaling 67%, worked in organizations between 1,000-4,999 employees or in organizations with more than 5,000 employees. Their responses hence provide an insight into the workings of relatively large-sized organizations. One important outcome of the survey is the finding that more IOs will increasingly adopt cloud services in the near future. While slightly more than half of the respondents (55%) reported that their organization uses cloud computing in limited ways, 64% of respondents reported that their organization will be using cloud services in the near future, between one to three years. The survey also outlines the current uses of cloud computing services by international organizations. In particular, we gained insight into the types of records/data deployed to cloud computing. The use of websites and social media ranked the highest at 45%, while about 24% of responses reported the use of records in the other category, which includes personal recruitment data, travel records, data about contract management and logistics. Records such as financial documents show relatively low deployment to the cloud (7% of respondents). As we had only one respondent from the legal department, we were not able to effectively analyze the legal department s involvement in the drafting of service level agreements for cloud service providers in IOs. Nevertheless, we noted a significant difference between the involvement of archives and records professionals versus that of information technology professionals in drafting service level agreements. A significantly higher percentage of information technology professionals are involved in drafting a service level agreement for their organization as compared to records/archives professionals. While 36% of information technology professionals claimed to be largely involved in drafting a service level agreement, only 4% of the records and archives professionals claimed to be largely involved in drafting the agreement. 45% of information technology professionals also reported being partly involved in drafting a service level agreement, while only 13% of archives and records professionals claimed to be partly involved. The results from the survey also reflect a difference in the perceived benefits and risks to cloud computing between records and archives professionals and information technology professionals. The top perceived driver for the adoption of cloud services among the records and archives professionals is cost savings in hardware and software (75%), whereas information technology professionals perceive improved scalability of information technology infrastructure as the top driver for the adoption of cloud services in their organization (82%). With regards to the top barrier for the adoption of cloud services in their organization, 100% of records/archives professionals view the lack of protection of personal data/data breaches as a significant barrier. In contrast, information 20

21 technology professionals (100%) rank ownership and custody of records as a top barrier in cloud computing. The results from the survey can be supplemented with rich and thick descriptions gathered through the collection and analysis of qualitative interviews with relevant stakeholders in IOs. One area that can be explored in the interviews is the rationale behind the perceived drivers and barriers and whether an individual s perception on risk converges with or diverges from that of the organizational perspective. 21

22 Annex A: Other Findings Relating to the Management of Records and Data in International Organizations Figure 22: Does your organization have policies regarding the retention and disposal of records? Figure 23: Does your organization have policies regarding data protection/information privacy? Figure 24: Does your organization have policies regarding outsourcing, transfer and/or processing of data external to your organization? 22

23 Figure 25: Does your organization have policies regarding access to records by members of the public? Figure 26: Does your organization conduct a risk assessment of your records and/or information assets? Figure 27: Does your organization conduct audits of how data is held, processed and stored? 23

24 Figure 28: Does your organization conduct training and awareness programs relating to the management and preservation of records in your organization? 24